Comments

Hi!
Here is the patch that allows us to specify the name of tap interface
when -netdev bridge is used. It's like -netdev tap,ifname=xxx, but for
bridges.
** Motivation **
We've got zillions of VMs and would like to see meaningful names of tap
interfaces. This is really useful for for, e.g., system administrators
in case they want to run tcpdump on it.
** How it works **
Just specify a ifname= parameter as it is done if --netdev tap is used.
However, as it requires root privs, the interface renaming is
actually done by qemu-bridge-helper. --netdev tap,ifname=xxx will fail
if qemu is launched not from root.
** TODO **
1. Update docs
2. I'm afraid that net_init_tap should not run helper with
--br=DEFAULT_BRIDGE_INTERFACE . At least bridge name should be tunnable.
But this is a future work.
3. May be we should call qemu-bridge-helper for tap interface renamings
because it always has root privs?
From 079027fe3696de2e2adc8e60377b995dd9548eac Mon Sep 17 00:00:00 2001
From: Alexandre Kandalintsev <spam@messir.net>
Date: Thu, 21 Mar 2013 18:48:12 +0100
Subject: [PATCH] added support for ifname in -netdev bridge
Signed-off-by: Alexandre Kandalintsev <spam@messir.net>
---
include/net/net.h | 1 +
net/tap.c | 25 ++++++++++++++++---------
qapi-schema.json | 1 +
qemu-bridge-helper.c | 12 ++++++++++--
4 files changed, 28 insertions(+), 11 deletions(-)

On 03/21/2013 12:05 PM, Alexandre Kandalintsev wrote:
> Hi!> > > Here is the patch that allows us to specify the name of tap interface> when -netdev bridge is used. It's like -netdev tap,ifname=xxx, but for> bridges.>
> +++ b/qapi-schema.json> @@ -2676,6 +2676,7 @@> { 'type': 'NetdevBridgeOptions',> 'data': {> '*br': 'str',> + '*ifname': 'str',> '*helper': 'str' } }
You also need to add a line documenting this field:
# @ifname: #optional Set the interface name that will be used (since 1.5).

On Thu, Mar 21, 2013 at 07:05:09PM +0100, Alexandre Kandalintsev wrote:
> Hi!> > > Here is the patch that allows us to specify the name of tap interface> when -netdev bridge is used. It's like -netdev tap,ifname=xxx, but for> bridges.> > > ** Motivation **> > We've got zillions of VMs and would like to see meaningful names of tap> interfaces. This is really useful for for, e.g., system administrators> in case they want to run tcpdump on it.> > > ** How it works **> > Just specify a ifname= parameter as it is done if --netdev tap is used.> However, as it requires root privs, the interface renaming is> actually done by qemu-bridge-helper. --netdev tap,ifname=xxx will fail> if qemu is launched not from root.> > > ** TODO **> > 1. Update docs> 2. I'm afraid that net_init_tap should not run helper with> --br=DEFAULT_BRIDGE_INTERFACE . At least bridge name should be tunnable.> But this is a future work.> 3. May be we should call qemu-bridge-helper for tap interface renamings> because it always has root privs?
qemu-bridge-helper is a setuid root binary. It allows access to things
an unprivileged user normally cannot do. We need to be very careful
that new features cannot be abused.
There needs to be a policy in qemu-bridge-helper to control network
interface naming.
Imagine an existing qemu-bridge-helper deployment. Now if your patch is
merged and the new qemu-bridge-helper is installed, unprivileged users
can create arbitrarily named network interfaces.
It was previously not possible to create arbitrarily named network
interfaces. This might pose a security problem given firewall
configuration, monitoring software, etc which isn't configured to deal
with these new interface names.
By default, custom names should not be allowed. Perhaps the
qemu-bridge-helper configuration file needs an option to specify a glob
pattern, e.g. vm*.
This way the host system administrator can restrict network interface
names while still allowing humand-friendly names.
Stefan

Hi William,
I was worried that the amount of changes would
turn the maintainers away from the patch.
Another problem is that I think there is little demand
for this patch.
But let's try to push it once again. Give me a week or
two and I'll submit a new version.
--
best regards,
Alexandre
> Hi Alexandre,> > On Mon, Mar 25, 2013 at 10:28 PM, Alexandre Kandalintsev> <spam@messir.net> wrote:> > Ok, lets go this way. We will define patterns in bridge.conf like> > ~~~> > allowifname vm*> > ~~~> > Do you have any news about this patch?> > Regards,

On Mon, Jan 20, 2014 at 10:23 PM, Alexandre Kandalintsev
<spam@messir.net> wrote:
> I was worried that the amount of changes would> turn the maintainers away from the patch.>> Another problem is that I think there is little demand> for this patch.>> But let's try to push it once again. Give me a week or> two and I'll submit a new version.
ack; please cc me when re-submitting.
Thanks,